KsepShimDatabaseTime

NTSTATUS __stdcall KsepShimDatabaseTime(PCWSTR SourceString){
  _QWORD *v1; 
  _QWORD *v2; 
  NTSTATUS v3; 
  int v4; 
  __int64 v5; 
  char v6; 
  __int64 v8; 
  UINT64 ShareAccess; 
  UINT64 v10; 
  VOID *FileHandle; 
  _UNICODE_STRING DestinationString; 
  _IO_STATUS_BLOCK IoStatusBlock; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  __int128 FileInformation; 
  __int128 v16; 
  __int64 v17; 

  *(&ObjectAttributes.Length + 1) = 0;
  *v1 = 0i64;
  *(&ObjectAttributes.Attributes + 1) = 0;
  FileHandle = 0i64;
  v2 = v1;
  v17 = 0i64;
  DestinationString = 0i64;
  IoStatusBlock = 0i64;
  FileInformation = 0i64;
  v16 = 0i64;
  RtlInitUnicodeString(&DestinationString, SourceString);
  LODWORD(v10) = 0;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.Length = 48;
  ObjectAttributes.Attributes = 576;
  LODWORD(ShareAccess) = 5;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  v3 = ZwOpenFile(&FileHandle, 0x80000000ui64, &ObjectAttributes, &IoStatusBlock, ShareAccess, v10);
  v4 = v3;
  if( v3 >= 0 )
  {
    v4 = ZwQueryInformationFile(FileHandle, &IoStatusBlock, &FileInformation, 0x28ui64, FileBasicInformation);
    if( v4 < 0 )
    {
      v8 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
      KsepHistoryErrors[2 * v8 + 1] = v4;
      KsepHistoryErrors[2 * v8] = 590737;
      if( (KsepDebugFlag & 2) != 0 )
        KsepDebugPrint(0i64, "KSE: ZwQueryInformationFile failed getting DB file!\n");
      KsepLogError(0, "KSE: ZwQueryInformationFile failed getting DB file!\n");
    }
    else
    {
      *v2 = v16;
    }
  }
  else
  {
    v5 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
    KsepHistoryErrors[2 * v5 + 1] = v3;
    v6 = KsepDebugFlag;
    KsepHistoryErrors[2 * v5] = 590724;
    if( (v6 & 2) != 0 )
      KsepDebugPrint(0i64, "KSE: ZwOpenFile failed opening DB file!\n");
    KsepLogError(0, "KSE: ZwOpenFile failed opening DB file!\n");
  }
  if( FileHandle )
    ZwClose((_HANDLE)FileHandle);
  return v4;
}

Referenced by: